Researchers say few HR leaders can put a number on it, and that gap is stalling the fixes.
Many organizations still sort their most serious threats into high, medium, and low without ever attaching a dollar figure, leaving IT leaders unable to show what a given risk could actually cost the business.
New research from Info-Tech Research Group centres on that gap.
Qualitative ratings are quick and common, according to Info-Tech, but they still cannot tell executives what a risk will cost in dollars, the number the firm says leaders most want when weighing trade-offs.
"Organizations are making decisions on their most severe risks without truly understanding their impact in financial terms," said Anubhav Sharma, principal research director at Info-Tech Research Group.
He added that "if risk cannot be expressed in financial terms, leaders cannot justify mitigation investments or influence board-level decisions."
Legacy assessment methods served compliance reporting rather than decision-making, the firm said, and several weaknesses persist.
Info-Tech points to a lack of financial context that makes mitigation spending hard to justify, subjective scoring that erodes executive confidence, and siloed, incomplete data that undercuts accuracy.
Full quantitative modelling, according to the research, tends to be so complex and data-heavy that it is impractical to sustain, while reporting-oriented outputs do little to support strategic decisions.
When risk carries only a "high" label, McCubbin said, IT leaders struggle to fund a response and still wear the blame when something breaks.
Putting risk in business terms, she added, lets executives "share" the decision.
Info-Tech's blueprint, Execute Data-Driven Risk Assessments, blends the two methods rather than choosing between them.
Teams use qualitative scoring to prioritize risks first, the firm said, then run a targeted financial analysis on only the most critical exposures.
The four-phase process starts with building a single risk register and shared taxonomy for enterprise-wide visibility, then moves to a qualitative assessment of likelihood and impact to rank the most severe risks.
A deeper quantitative stage follows, estimating single loss impact, occurrence frequency, and annualized loss expectancy to convert exposure into dollars.
The final phase turns those findings into business terms for executive-level decisions.
The blueprint ships with a storyboard, a risk assessment workbook, and a risk owner communication deck, the firm said, which contends the method helps organizations produce credible financial ranges and explain what is driving their exposure.
The firm describes itself as a research and advisory firm working with IT, HR, and marketing leaders.
